Privacy Policy — Klear
1. What this document covers
Klear is a case-management system (CRM) for law firms ("the Firm", "the Client"), operated as a multi-tenant SaaS service — each firm gets its own separate, isolated database. This policy explains how Klear processes personal data while providing the service to a firm, and the rights of the data subjects whose data is processed (the firm's staff, its clients, and other parties to a case).
This policy does not replace the individual privacy policy each client firm publishes toward its own clients — that is the firm's responsibility as data controller (see section 2). This policy governs the relationship between Klear (as processor) and the firm (as controller), and our commitments toward every data subject whose data passes through the system.
2. Controller vs. processor — Israel's Privacy Protection Law
Under the Israeli Privacy Protection Law, 5741-1981, and its regulations:
- The Firm is the Data Controller — it decides what data is collected about its clients, for what purpose, and how long it must be retained for professional/regulatory reasons. The relationship between the firm and its clients (disclosure, consent, etc.) is the firm's responsibility.
- Klear is the Data Processor — we process data on the firm's behalf and only per its instructions, and commit to: not using the data for any purpose other than providing the service; protecting it with appropriate security measures (section 5); deleting or returning data per the firm's instructions at the end of the engagement (section 6); and notifying the firm of any security incident (section 7).
- The full relationship (rights, obligations, detailed security measures, sub-processors) is also set out in a Data Processing Agreement (DPA) signed with each firm — this policy is the public summary; the DPA is the binding contractual document.
- Attorney-client privilege: legal-case data is subject to attorney-client privilege. Structural multi-tenant isolation (a separate database per firm, not merely permissions) is our primary means of respecting that privilege — not just good engineering, but a legal necessity.
3. What personal data is processed, and why
Klear processes the following categories of information in the course of providing the case-management service:
| Category | Examples | Why (purpose of processing) |
|---|---|---|
| Firm user details | Name, email, role, login details | User-account management, role permissions, authentication |
| Case party details | Full name, national ID/company number, phone, email, address, date of birth | Managing the legal case — parties, representatives, the firm's own clients |
| Case documents | Pleadings, contracts, correspondence, rulings | Core service — managing and storing case documents |
| Scheduling data | Deadlines, court hearings, tasks | Computing and managing legal deadlines |
| Billing data (of the firm itself, as Klear's customer) | Payment details, invoices | Billing the firm for use of the service |
| Usage/log data | IP address, user agent, timestamps, audit log | Security, fraud prevention, regulatory compliance |
| Data in optional modules | WhatsApp message content, AI drafts, digital signatures | Only if the firm has enabled that module — see section 4 |
| Calendar/contacts data synced to Google (optional, per-lawyer) | Hearing date/title · a contact's name/phone/email/address (no national ID) | Only if an individual lawyer chose to connect their own personal Google account — see section 4 |
Data-minimisation principle: sensitive fields (national ID numbers, full names, phone, email, address, date of birth) are encrypted at rest, and shown masked in list/search views (e.g. "ID ••••••4821") — the full value is decrypted only on an explicit, logged action.
4. Sub-processors
Some processing is carried out with the help of external sub-processors. Key principles:
- Every sub-processor tied to an optional module (AI, communications, e-signatures) is opt-in — a firm on the base plan shares no data with any of them. Data reaches such a provider only if the firm has explicitly enabled the relevant module.
- "Core" sub-processors (necessary for the service to function for every firm — document storage, court-portal sync) are likewise documented, including the scope of data that flows to them.
- Google integrations (calendar, contacts, mail) are a different category: not a firm-module opt-in, but a personal opt-in by each individual lawyer to their own personal Google account — independent of whatever plan/modules the firm purchased. Once data is written to a lawyer's personal Google account, it leaves Klear's control: the retention/deletion/export commitments in section 6 apply only to what remains in Klear's own infrastructure.
- A change to the sub-processor list (addition/replacement) is documented and notified to client firms in advance, per the mechanism set out in the DPA.
Limited Use disclosure (Google API Services User Data Policy). To the extent Klear connects to a lawyer's personal Gmail account, Klear's use of information received via Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: the information is used solely to provide the feature for which the lawyer connected their account — never transferred to third parties, never used for advertising or ad-related research, and never used to train general-purpose AI models. Human access to content occurs only with the lawyer's explicit consent, for security/support/ legal-compliance purposes, or once the data has been anonymised/aggregated. This section applies only to a lawyer who chose to connect their account.
5. Security measures
- Structural multi-tenant isolation — a separate database per firm; the application code never manually filters by a firm identifier — isolation is a property of the base layer, not developer discipline.
- Encryption at rest — sensitive personal fields are encrypted at the application layer; document files are encrypted in S3-compatible storage.
- Audit log — every write action in the system (and sensitive reads such as decrypting a full national ID or downloading a document) is logged: who, when, what, from which token.
- Access control — role-based permissions within each firm, session/OAuth-based authentication depending on the client type, and a token can never exceed the permissions of the user behind it.
- Transport hardening — HTTPS enforced in production, secure cookies, security headers on every response.
- Rate limiting and monitoring of failed authentication attempts, to prevent abuse.
6. Data-subject rights — retention, deletion and export
- Retention: a firm's data is retained for as long as the engagement is active, and per the retention periods required for professional/regulatory reasons (e.g. retention of legal records).
- Deletion at end of engagement: after subscription cancellation and a defined grace window, the firm's data (its dedicated database and its documents) is physically and permanently deleted.
- Data portability: every firm has the right to a full export of its data (cases, parties, documents, meetings, decisions) in a readable format, at any time and certainly before the engagement ends.
- Correction/update: firm users correct inaccurate data themselves through the system; correction requests beyond that are directed to the DPO (section 8).
- As a rule, a third-party request (e.g. an end client of the firm asking to delete their data) is directed straight to the firm (the controller), since Klear acts only on the firm's instructions as processor. Klear will assist the firm in fulfilling such a request within the system (targeted export/deletion) as needed.
7. Security-incident notification
Klear commits to following a documented incident-response procedure — detection, containment, scope assessment (via the audit log, section 5), and notification to the affected firms and the regulator within the window required by law.
8. Contact & DPO
For any question, request or complaint regarding privacy and personal-data processing within Klear:
- Responsible party (DPO / privacy inquiries): Chaim Marcus Law Office
- Email: dpo@marcus-law.co.il
- Registered address: HaZayit 45, Tzur Hadassah, Israel
We respond within a reasonable time and in any case as required by law. A client firm seeking to help its own end client exercise a right (deletion/export/correction) may contact the same address.
9. Updates to this policy
This policy may be updated as the service evolves (new modules, additional sub-processors, regulatory changes). A material change is communicated to client firms in advance, per the mechanism set out in the DPA.